{
  "cveId": "CVE-2022-2906",
  "url": "https://patchblox.com/security/cve/CVE-2022-2906",
  "summary": "CVE-2022-2906 is fixed in 7 products on 1 platform, first by bind9 1:9.18.1-1ubuntu1.2, released September 20, 2022. It is not reported as exploited. Patch Radar priority: High.",
  "title": "bind9: An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of r...",
  "description": "An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service.",
  "published": "2022-09-20T17:00:00Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.02048,
  "epssPercentile": 0.81335,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "bind9",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "1:9.18.7-1",
      "fix": "DEBIAN-CVE-2022-2906",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-2906",
      "released": "2022-09-21T11:15:09Z"
    },
    {
      "platform": "linux",
      "product": "bind9",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1:9.18.7-1",
      "fix": "DEBIAN-CVE-2022-2906",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-2906",
      "released": "2022-09-21T11:15:09Z"
    },
    {
      "platform": "linux",
      "product": "bind9",
      "release": "Debian 14",
      "fixedVersion": "1:9.18.7-1",
      "fix": "DEBIAN-CVE-2022-2906",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-2906",
      "released": "2022-09-21T11:15:09Z"
    },
    {
      "platform": "linux",
      "product": "bind9",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "bind9 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-bind9-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bind9-dnsutils",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "bind9-dnsutils 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-bind9-dnsutils-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bind9-host",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "bind9-host 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-bind9-host-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bind9-libs",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "bind9-libs 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-bind9-libs-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bind9-utils",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "bind9-utils 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-bind9-utils-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "bind9utils",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "bind9utils 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-bind9utils-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    },
    {
      "platform": "linux",
      "product": "dnsutils",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1:9.18.1-1ubuntu1.2",
      "fix": "dnsutils 1:9.18.1-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-dnsutils-1-9.18.1-1ubuntu1.2",
      "released": "2022-09-20T17:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}